CVE-2021-46977

What it actually does

Race condition in KVM VMX code where preemption between RDMSR and WRMSR on user return MSRs can corrupt per-CPU host MSR values when rescheduled on a different logical CPU.

Why it matters to the business

May cause instability or incorrect state in virtualized workloads on Linux hosts using Intel virtualization, increasing operational risk in environments with many VMs.

How an attack unfolds

An attacker with guest access triggers KVM's user return MSR probing and forces preemption plus CPU migration between the read and write operations to corrupt host MSR state.

How to fix it

Apply the Linux kernel patch that disables preemption around the user return MSR probe helper; rebuild and reboot with the fixed kernel.

How to confirm the fix worked

Inspect KVM VMX source for the added preempt_disable/preempt_enable pair around RDMSR/WRMSR calls and confirm the common x86 helper is present.

Typical attack path

1. Obtain code execution inside a guest VM on a vulnerable KVM host
2. Trigger user return MSR probe path in VMX exit handling
3. Force scheduler preemption and migration to a different CPU during the RDMSR-WRMSR window
4. Observe or abuse resulting host MSR corruption

How to detect it

Review kernel logs for unexpected MSR write failures or virtualization exits around preemption; examine auditd or dmesg entries mentioning RDMSR/WRMSR in KVM context.

What your security team should do

• Prioritize kernel updates on all Intel KVM hosts
• Test virtualization workloads after patching for MSR-related stability
• Review guest isolation controls until patches are deployed